Skip to main content
Medclaim Services Logo

Menu

Free Billing Audit

HIPAA compliance

HIPAA Compliance at MEDCLAIM Services

A billing company cannot do its job without seeing patient information, so HIPAA applies to the work from the first login. This page explains what the rules require of a billing company working for your practice, what you should expect in writing, and how our website keeps patient data out of reach entirely.

  • What makes a billing company a business associate
  • The written agreement HIPAA requires before data is shared
  • Why our website forms never ask for patient information
Request a Free Billing Audit

Billing companies are business associates

Under HIPAA, an outside company that creates, receives, keeps or sends protected health information while doing billing or claims work for a covered entity is a business associate of that covered entity. For a billing company, that describes nearly every task, from posting payments to appealing denials.

Before sharing patient information with a business associate, a practice needs written assurances from it, set out in a contract or other written agreement. That agreement describes how the data may be used and disclosed and what happens to it when the work ends.

Official sources: eCFR: 45 CFR 160.103 (business associate definition) (external site), eCFR: 45 CFR 164.502 (disclosures to business associates) (external site)

What the HIPAA rules expect of a business associate

  • Protect electronic patient data

    Business associates must keep electronic protected health information confidential, accurate and available, and guard it against threats and uses the rules do not allow.

  • Assess risks to that data

    The Security Rule calls for a documented assessment of the risks and weaknesses that could expose electronic patient data, followed by measures to reduce them.

  • Use only what the task needs

    Uses and disclosures of patient information are limited to the minimum necessary for the purpose, which for billing means access to what the claim work requires.

  • Report breaches to the practice

    If a business associate discovers a breach of unsecured protected health information, it must notify the covered entity, within the deadline the Breach Notification Rule sets.

Official sources: eCFR: 45 CFR 164.306 (security standards) (external site), eCFR: 45 CFR 164.308 (administrative safeguards) (external site), eCFR: 45 CFR 164.410 (notification by a business associate) (external site)

How we handle patient information

We work only inside the systems your practice already controls, through user accounts your staff create and can remove at any time. Patient information stays in your practice management system, clearinghouse and payer portals rather than being copied elsewhere for convenience.

Before any patient data is shared, we agree with your practice the HIPAA paperwork and safeguards it requires, and we walk through our own policies during onboarding. If your compliance officer has a checklist for vendors, send it to us early and we will work through it with you.

Patient information and this website

Our website is for practices, not patients. The contact and audit forms ask only about your practice, your role and your billing needs, and each form tells you not to include patient names, diagnoses, insurance member IDs or any other patient information.

The free billing audit works from summary reports, such as A/R aging and denial reports by reason code, so it can be completed without any patient-level data. Our privacy policy explains what the website does collect and how it is used.

Frequently asked questions

Is MEDCLAIM Services "HIPAA certified"?

We do not describe ourselves that way. What matters under HIPAA is how a company handles patient data in practice and what it agrees to in writing, which we cover with each practice before any data is shared.

Do we need a written agreement before you see patient data?

HIPAA requires a practice to have written assurances from a business associate before sharing patient information with it. We confirm those arrangements with your practice before access is set up.

Can we limit what your team can access?

Yes. Your practice sets up our user accounts, so you decide which systems and functions we can reach, and you can review or remove that access at any time.

Should we send claim examples by email?

No. Please do not email patient information. When we need claim-level detail, we review it inside your own systems under the access you have given us.

Start without sharing patient data

The free billing audit uses summary reports only. Request one and see where your revenue is leaking.

Request a Free Billing Audit

Related pages